{"id":"CVE-2014-9684","aliases":["EUVD-2015-0034","GHSA-h737-q6g6-8wr6","PYSEC-2015-37","RHSA-2015:0938","SUSE-SU-2015:1515-1"],"status":"published","title":"OpenStack Glance Denial of service by creating a large number of images","description":"OpenStack Image Registry and Delivery Service (Glance) 2014.2 through 2014.2.2 does not properly remove images, which allows remote authenticated users to cause a denial of service (disk consumption) by creating a large number of images using the task v2 API and then deleting them before the uploads finish, a different vulnerability than CVE-2015-1881.","severity":{"version":"2.0","score":4,"vector":"AV:N/AC:L/Au:S/C:N/I:N/A:P","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.01997,"percentile":0.80864,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-399","CWE-770"],"published":"2015-02-24T15:00:00Z","modified":"2026-10-08T10:01:08Z","fixes":[{"ecosystem":"PyPI","package":"glance","fixed_in":["11.0.0a0"],"sources":["ghsa","osv"]},{"ecosystem":"SUSE:OpenStack Cloud 5","package":"openstack-ceilometer","fixed_in":["2014.2.4.dev18-9.7"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 5","package":"openstack-ceilometer-doc","fixed_in":["2014.2.4.dev18-9.11"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 5","package":"openstack-cinder","fixed_in":["2014.2.4.dev19-9.7"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 5","package":"openstack-cinder-doc","fixed_in":["2014.2.4.dev19-9.12"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 5","package":"openstack-glance","fixed_in":["2014.2.4.dev5-9.5"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 5","package":"openstack-glance-doc","fixed_in":["2014.2.4.dev5-9.7"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 5","package":"openstack-heat","fixed_in":["2014.2.4.dev13-9.6"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 5","package":"openstack-heat-doc","fixed_in":["2014.2.4.dev13-9.8"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 5","package":"openstack-keystone","fixed_in":["2014.2.4.dev5-11.8"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 5","package":"openstack-keystone-doc","fixed_in":["2014.2.4.dev5-11.12"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 5","package":"openstack-sahara","fixed_in":["2014.2.4.dev3-9.5"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 5","package":"openstack-sahara-doc","fixed_in":["2014.2.4.dev3-9.5"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 5","package":"openstack-suse","fixed_in":["2014.2-9.2"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 5","package":"python-oslo.i18n","fixed_in":["1.3.1-9.6"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 5","package":"python-oslo.utils","fixed_in":["1.4.0-14.2"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 5","package":"python-oslotest","fixed_in":["1.2.0-2.5"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 5","package":"python-six","fixed_in":["1.9.0-9.2"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"glance","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.0.0a0"}]}]},{"source":"osv","ecosystem":"PyPI","package":"glance","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.0.0a0"}]}]},{"source":"osv","ecosystem":"PyPI","package":"glance","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.0.0a0"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:6::el7","package":"openstack-glance","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2014.2.3-1.el7ost"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openstack:6::el7","package":"openstack-glance-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2014.2.3-1.el7ost"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openstack:6::el7","package":"python-glance","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2014.2.3-1.el7ost"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openstack:6::el7","package":"python-glance-store","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.1.10-3.el7ost"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 5","package":"openstack-ceilometer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2014.2.4.dev18-9.7"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 5","package":"openstack-ceilometer-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2014.2.4.dev18-9.11"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 5","package":"openstack-cinder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2014.2.4.dev19-9.7"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 5","package":"openstack-cinder-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2014.2.4.dev19-9.12"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 5","package":"openstack-glance","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2014.2.4.dev5-9.5"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 5","package":"openstack-glance-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2014.2.4.dev5-9.7"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 5","package":"openstack-heat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2014.2.4.dev13-9.6"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 5","package":"openstack-heat-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2014.2.4.dev13-9.8"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 5","package":"openstack-keystone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2014.2.4.dev5-11.8"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 5","package":"openstack-keystone-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2014.2.4.dev5-11.12"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 5","package":"openstack-sahara","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2014.2.4.dev3-9.5"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 5","package":"openstack-sahara-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2014.2.4.dev3-9.5"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 5","package":"openstack-suse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2014.2-9.2"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 5","package":"python-oslo.i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.1-9.6"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 5","package":"python-oslo.utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.0-14.2"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 5","package":"python-oslotest","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.0-2.5"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 5","package":"python-six","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.0-9.2"}]}]}],"products":[{"vendor":"openstack","product":"image_registry_and_delivery_service_\\(glance\\)"}],"references":[{"url":"http://lists.openstack.org/pipermail/openstack-announce/2015-February/000336.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Vendor Advisory","web","advisory"]},{"url":"https://bugs.launchpad.net/glance/+bug/1371118","tags":["x_refsource_CONFIRM","x_transferred","Exploit","web","evidence"]},{"url":"http://rhn.redhat.com/errata/RHSA-2015-0938.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","web","advisory"]},{"url":"http://www.securityfocus.com/bid/72692","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-9684","tags":["advisory"]},{"url":"https://github.com/openstack/glance/commit/7858d4d95154c8596720365e465cca7858cfec5c","tags":["web"]},{"url":"https://github.com/openstack/glance/commit/a880c8e762e94b70c1e5d5692a3defcde734a601","tags":["web"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/glance/PYSEC-2015-37.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-h737-q6g6-8wr6","tags":["advisory"]},{"url":"https://github.com/openstack/glance","tags":["package"]},{"url":"https://access.redhat.com/errata/RHSA-2015:0938","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/site/documentation/en-US/Red_Hat_Enterprise_Linux_OpenStack_Platform/6/html/Release_Notes/index.html","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1194697","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1210457","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_0938.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-9684","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-9684","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-1881","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-1881","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-1881","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2015/suse-su-20151515-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/918784","tags":["report"]},{"url":"https://bugzilla.suse.com/920573","tags":["report"]},{"url":"https://bugzilla.suse.com/926596","tags":["report"]},{"url":"https://bugzilla.suse.com/928718","tags":["report"]},{"url":"https://bugzilla.suse.com/930574","tags":["report"]},{"url":"https://bugzilla.suse.com/931204","tags":["report"]},{"url":"https://bugzilla.suse.com/935892","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9684","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2014-9684","description":"OpenStack Image Registry and Delivery Service (Glance) 2014.2 through 2014.2.2 does not properly remove images, which allows remote authenticated users to cause a denial of service (disk consumption) by creating a large number of images using the task v2 API and then deleting them before the uploads finish, a different vulnerability than CVE-2015-1881.","status":"published","published":"2015-02-24T15:00:00Z","modified":"2024-08-06T13:55:04.449Z","updated_at":"2026-11-02T14:33:42.54191Z"}],"euvd":[{"id":"EUVD-2015-0034","description":"OpenStack Image Registry and Delivery Service (Glance) 2014.2 through 2014.2.2 does not properly remove images, which allows remote authenticated users to cause a denial of service (disk consumption) by creating a large number of images using the task v2 API and then deleting them before the uploads finish, a different vulnerability than CVE-2015-1881.","status":"published","published":"2015-02-24T15:00:00Z","modified":"2024-08-06T13:55:04Z","updated_at":"2026-11-03T01:56:47.514809Z"}],"ghsa":[{"id":"GHSA-h737-q6g6-8wr6","title":"OpenStack Glance Denial of service by creating a large number of images","description":"OpenStack Image Registry and Delivery Service (Glance) 2014.2 through 2014.2.2 does not properly remove images, which allows remote authenticated users to cause a denial of service (disk consumption) by creating a large number of images using the task v2 API and then deleting them before the uploads finish, a different vulnerability than CVE-2015-1881.","status":"published","published":"2022-05-17T03:10:45Z","modified":"2024-11-26T18:25:27Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:38:23.575854Z"}],"nvd":[{"id":"CVE-2014-9684","description":"OpenStack Image Registry and Delivery Service (Glance) 2014.2 through 2014.2.2 does not properly remove images, which allows remote authenticated users to cause a denial of service (disk consumption) by creating a large number of images using the task v2 API and then deleting them before the uploads finish, a different vulnerability than CVE-2015-1881.","status":"published","published":"2015-02-24T15:59:03.537Z","modified":"2026-06-17T00:18:48.007Z","cvss":[{"version":"2.0","score":4,"vector":"AV:N/AC:L/Au:S/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-399"],"updated_at":"2026-11-02T14:02:58.385843Z"}],"osv":[{"id":"GHSA-h737-q6g6-8wr6","title":"OpenStack Glance Denial of service by creating a large number of images","description":"OpenStack Image Registry and Delivery Service (Glance) 2014.2 through 2014.2.2 does not properly remove images, which allows remote authenticated users to cause a denial of service (disk consumption) by creating a large number of images using the task v2 API and then deleting them before the uploads finish, a different vulnerability than CVE-2015-1881.","status":"published","published":"2022-05-17T03:10:45Z","modified":"2024-11-26T18:25:27Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"},{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T15:46:48.920784Z"},{"id":"PYSEC-2015-37","description":"OpenStack Image Registry and Delivery Service (Glance) 2014.2 through 2014.2.2 does not properly remove images, which allows remote authenticated users to cause a denial of service (disk consumption) by creating a large number of images using the task v2 API and then deleting them before the uploads finish, a different vulnerability than CVE-2015-1881.","status":"published","published":"2015-02-24T15:59:00Z","modified":"2026-07-02T10:30:22.5154005Z","updated_at":"2026-11-02T15:52:51.645172Z"},{"id":"RHSA-2015:0938","title":"Red Hat Security Advisory: openstack-glance security and bug fix update","status":"published","published":"2024-09-15T22:31:50Z","modified":"2026-10-08T10:01:08Z","updated_at":"2026-11-02T15:53:03.182161Z"},{"id":"SUSE-SU-2015:1515-1","title":"Security update for openstack and python-oslo.utils","description":"\nThis update provides the following fixes provided from the upstream OpenStack-project:\n\n- openstack-suse:\n  + do not copy upstream python requirements to the package, we rely on Requires; upstream requirements.txt introduce version caps which we do not follow (bnc#920573)\n\n- openstack-sahara:\n  + Fix getting heat stack in Sahara\n  + Fixed scaling with new node group with auto sg\n  + Open all ports for private network for auto SG\n  + Fix for getting auth url for hadoop-swift\n  + Fixed auto security group cleanup in case of creation error\n  + Add list of open ports for Cloudera plugin\n  + Add missed files for migrations in MANIFEST.in\n  + Include launch_command.py in MANIFEST.in\n  + Fix requires\n\n- openstack-keystone:\n  + Updated hybrid backend to include fix for bsc#935892\n  + Deal with PEP-0476 certificate chaining checking\n  + Backport fixes for v3 API sample policy file (lp#1381809 and lp#1392155).\n  + Install v3 sample policy into the doc directory\n  + Update hybrid backend to include latest fixes for v3 protocol (bsc#928718)\n  + backend_argument should be marked secret\n  + Work with pymongo 3.0\n  + Speed up memcache lock\n  + Fix up _ldap_res_to_model for ldap identity backend\n  + Don't try to convert LDAP attributes to boolean\n  + Fix the wrong update logic of catalog kvs driver\n  + Do parameter check before updating endpoint_group\n  + Correct initialization order for logging to use eventlet locks\n  + Fix the syntax issue on creating table `endpoint_group`\n\n- openstack-heat:\n  + Add env storing for loaded environments\n  + Fix block_device_mapping property validation when using get_attr\n  + Add default_client_name in Nova::FloatingIPAssoc\n  + Fix cloud-init Python syntax for Python \u003c 2.6\n  + Allow lists and strings for Json parameters via provider resources\n  + RandomString physical_resource_id as id not the string\n  + Authenticate the domain user with id instead of username\n  + Tell stevedore not to force verify requirements\n  + Use properties.data when testing for 'provided by the user'\n  + Ship /usr/lib/heat directory in openstack-heat-engine subpackage, since that's where plugin are loaded from.\n  + Create openstack-heat-plugin-heat_docker subpackage to ship the heat_docker plugin.\n  + Fix update on failed stack\n  + Enable https for keystone while creating stack user\n  + Change the engine-listener topic\n  + Just to delete the stack when adopt rollback\n  + Release stack lock when successfully acquire\n  + Add dependency on Router External Gateway property\n  + Use only FIP dependencies from graph\n  + Add dependency hidden on router_interface\n  + Update heat.conf.sample\n  + Upgrade requirements for kombu and greenlet to Juno versions (bnc#920573)\n  + Stop patching oslo.messaging private bits\n\n- openstack-glance:\n  + Eventlet green threads not released back to pool\n  + Replace assert statements with proper control-flow\n  + Fix intermittent unit test failures\n  + Initiate deletion of image files if the import was interrupted to prevent denial of service (bnc#918784, CVE-2014-9684)\n\n- openstack-cinder:\n  + Remove nonexistent LIO terminate_connection call\n  + Disallow backing files when uploading volumes to image\n  + LVM: Pass volume size in MiB to copy_volume() during volume migration\n  + Remove iscsi_helper calls from base iscsi driver\n  + Fix exceptions logging in iSCSI targets\n  + Delete the temporary volume if migration fails\n  + Get the 'consumer' in a correct way for retyping with qos-specs\n  + Fix re-export of iscsi volume when using lioadm\n  + Revert 'Add support for customized cluster name'\n  + Failed to discovery when iscsi multipath and CHAP both enabled\n  + Add support for customized cluster name\n  + Only use operational LIFs for iscsi target details\n  + Clear migration_status from a destination volume if migration fails\n  + Deal with PEP-0476 certificate chaining checking\n\n- openstack-ceilometer:\n  + Ensure unique list of consumers created\n  + Add bandwidth to measurements\n  + Rely on VM UUID to fetch metrics in libvirt\n  + Retry to connect database when DB2 or mongodb is restarted\n  + Use alarm's evaluation periods in sufficient test\n  + [MongoDB] Fix bug with reconnection to new master node\n  + Fix the value of query_spec.maxSample to advoid to be zero\n  + Fix issue when ceilometer-expirer is called from the wrong user via cronjob and the resulting logs end up having wrong ownership. See also bsc#930574\n  + Metering data ttl sql backend breaks resource metadata\n  + Stop mocking os.path in test_setup_events_default_config\n  + Move the cron job to collector package (bnc#926596) \n  + Catch exception when evaluate single alarm\n    \n- python-oslo.utils:\n  + Update to version 1.4.0\n    * Add a stopwatch + split for duration(s)\n    * Allow providing a logger to save_and_reraise_exception\n    * Utility API to generate EUI-64 IPv6 address\n    * Add a eventlet utils helper module\n    * Add microsecond support to iso8601_from_timestamp\n    * Update Oslo imports to remove namespace package\n    * Add TimeFixture\n    * Add microsecond support to timeutils.utcnow_ts()\n\n- python-oslo.i18n:\n  + Update to version 1.3.1\n    * Remove deprecation warning (bnc#931204)\n    * Correct the translation domain for loading messages\n    * Workflow documentation is now in infra-manual\n    * Imported Translations from Transifex\n    * Activate pep8 check that _ is imported\n    * Make clear in docs to use _LE() when using LOG.exception()\n    * Support building wheels (PEP-427)\n\n- python-six:\n  + Update to version 1.9.0\n    * Support the `flush` parameter to `six.print_`.\n    * Add the `python_2_unicode_compatible` decorator.\n    * Ensure `six.wraps` respects the *updated* and *assigned* arguments.\n    * Fix `six.moves` race condition in multi-threaded code.\n    * Add `six.view(keys|values|itmes)`, which provide dictionary views on Python 2.7+.\n    * Fix add_metaclass when the class has __slots__ containing '__weakref__' or '__dict__'.\n    * Always accept *updated* and *assigned* arguments for wraps().\n    * Fix import six on Python 3.4 with a custom loader.\n","status":"published","published":"2015-08-25T08:34:56Z","modified":"2026-02-04T02:38:11.415734Z","updated_at":"2026-11-02T15:53:43.030986Z"}]}}